hxxps://en[.]irna[.]ir/news/85519944/Russia-sends-coal-to-India-via-Iran-by-train-for-first-time

Analysis

max time kernel
19s
max time network
20s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
04/09/2024, 14:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://en.irna.ir/news/85519944/Russia-sends-coal-to-India-via-Iran-by-train-for-first-time

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	api.ipify.org
14	api.ipify.org

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5992	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133699351490542660"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5992	chrome.exe
5992	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5992	chrome.exe
5992	chrome.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5992	chrome.exe
Token: SeCreatePagefilePrivilege	5992	chrome.exe
Token: SeShutdownPrivilege	5992	chrome.exe
Token: SeCreatePagefilePrivilege	5992	chrome.exe
Token: SeShutdownPrivilege	5992	chrome.exe
Token: SeCreatePagefilePrivilege	5992	chrome.exe
Token: SeShutdownPrivilege	5992	chrome.exe
Token: SeCreatePagefilePrivilege	5992	chrome.exe
Token: SeShutdownPrivilege	5992	chrome.exe
Token: SeCreatePagefilePrivilege	5992	chrome.exe
Token: SeShutdownPrivilege	5992	chrome.exe
Token: SeCreatePagefilePrivilege	5992	chrome.exe
Token: SeShutdownPrivilege	5992	chrome.exe
Token: SeCreatePagefilePrivilege	5992	chrome.exe
Token: SeShutdownPrivilege	5992	chrome.exe
Token: SeCreatePagefilePrivilege	5992	chrome.exe
Token: SeShutdownPrivilege	5992	chrome.exe
Token: SeCreatePagefilePrivilege	5992	chrome.exe
Token: SeShutdownPrivilege	5992	chrome.exe
Token: SeCreatePagefilePrivilege	5992	chrome.exe
Token: SeShutdownPrivilege	5992	chrome.exe
Token: SeCreatePagefilePrivilege	5992	chrome.exe
Token: SeShutdownPrivilege	5992	chrome.exe
Token: SeCreatePagefilePrivilege	5992	chrome.exe
Token: SeShutdownPrivilege	5992	chrome.exe
Token: SeCreatePagefilePrivilege	5992	chrome.exe
Token: SeShutdownPrivilege	5992	chrome.exe
Token: SeCreatePagefilePrivilege	5992	chrome.exe
Token: SeShutdownPrivilege	5992	chrome.exe
Token: SeCreatePagefilePrivilege	5992	chrome.exe
Token: SeShutdownPrivilege	5992	chrome.exe
Token: SeCreatePagefilePrivilege	5992	chrome.exe
Token: SeShutdownPrivilege	5992	chrome.exe
Token: SeCreatePagefilePrivilege	5992	chrome.exe
Token: SeShutdownPrivilege	5992	chrome.exe
Token: SeCreatePagefilePrivilege	5992	chrome.exe
Token: SeShutdownPrivilege	5992	chrome.exe
Token: SeCreatePagefilePrivilege	5992	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
5992	chrome.exe
5992	chrome.exe
5992	chrome.exe
5992	chrome.exe
5992	chrome.exe
5992	chrome.exe
5992	chrome.exe
5992	chrome.exe
5992	chrome.exe
5992	chrome.exe
5992	chrome.exe
5992	chrome.exe
5992	chrome.exe
5992	chrome.exe
5992	chrome.exe
5992	chrome.exe
5992	chrome.exe
5992	chrome.exe
5992	chrome.exe
5992	chrome.exe
5992	chrome.exe
5992	chrome.exe
5992	chrome.exe
5992	chrome.exe
5992	chrome.exe
5992	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5992	chrome.exe
5992	chrome.exe
5992	chrome.exe
5992	chrome.exe
5992	chrome.exe
5992	chrome.exe
5992	chrome.exe
5992	chrome.exe
5992	chrome.exe
5992	chrome.exe
5992	chrome.exe
5992	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5992 wrote to memory of 2316	5992	chrome.exe	78
PID 5992 wrote to memory of 2316	5992	chrome.exe	78
PID 5992 wrote to memory of 3232	5992	chrome.exe	79
PID 5992 wrote to memory of 3232	5992	chrome.exe	79
PID 5992 wrote to memory of 3232	5992	chrome.exe	79
PID 5992 wrote to memory of 3232	5992	chrome.exe	79
PID 5992 wrote to memory of 3232	5992	chrome.exe	79
PID 5992 wrote to memory of 3232	5992	chrome.exe	79
PID 5992 wrote to memory of 3232	5992	chrome.exe	79
PID 5992 wrote to memory of 3232	5992	chrome.exe	79
PID 5992 wrote to memory of 3232	5992	chrome.exe	79
PID 5992 wrote to memory of 3232	5992	chrome.exe	79
PID 5992 wrote to memory of 3232	5992	chrome.exe	79
PID 5992 wrote to memory of 3232	5992	chrome.exe	79
PID 5992 wrote to memory of 3232	5992	chrome.exe	79
PID 5992 wrote to memory of 3232	5992	chrome.exe	79
PID 5992 wrote to memory of 3232	5992	chrome.exe	79
PID 5992 wrote to memory of 3232	5992	chrome.exe	79
PID 5992 wrote to memory of 3232	5992	chrome.exe	79
PID 5992 wrote to memory of 3232	5992	chrome.exe	79
PID 5992 wrote to memory of 3232	5992	chrome.exe	79
PID 5992 wrote to memory of 3232	5992	chrome.exe	79
PID 5992 wrote to memory of 3232	5992	chrome.exe	79
PID 5992 wrote to memory of 3232	5992	chrome.exe	79
PID 5992 wrote to memory of 3232	5992	chrome.exe	79
PID 5992 wrote to memory of 3232	5992	chrome.exe	79
PID 5992 wrote to memory of 3232	5992	chrome.exe	79
PID 5992 wrote to memory of 3232	5992	chrome.exe	79
PID 5992 wrote to memory of 3232	5992	chrome.exe	79
PID 5992 wrote to memory of 3232	5992	chrome.exe	79
PID 5992 wrote to memory of 3232	5992	chrome.exe	79
PID 5992 wrote to memory of 3232	5992	chrome.exe	79
PID 5992 wrote to memory of 3732	5992	chrome.exe	80
PID 5992 wrote to memory of 3732	5992	chrome.exe	80
PID 5992 wrote to memory of 2176	5992	chrome.exe	81
PID 5992 wrote to memory of 2176	5992	chrome.exe	81
PID 5992 wrote to memory of 2176	5992	chrome.exe	81
PID 5992 wrote to memory of 2176	5992	chrome.exe	81
PID 5992 wrote to memory of 2176	5992	chrome.exe	81
PID 5992 wrote to memory of 2176	5992	chrome.exe	81
PID 5992 wrote to memory of 2176	5992	chrome.exe	81
PID 5992 wrote to memory of 2176	5992	chrome.exe	81
PID 5992 wrote to memory of 2176	5992	chrome.exe	81
PID 5992 wrote to memory of 2176	5992	chrome.exe	81
PID 5992 wrote to memory of 2176	5992	chrome.exe	81
PID 5992 wrote to memory of 2176	5992	chrome.exe	81
PID 5992 wrote to memory of 2176	5992	chrome.exe	81
PID 5992 wrote to memory of 2176	5992	chrome.exe	81
PID 5992 wrote to memory of 2176	5992	chrome.exe	81
PID 5992 wrote to memory of 2176	5992	chrome.exe	81
PID 5992 wrote to memory of 2176	5992	chrome.exe	81
PID 5992 wrote to memory of 2176	5992	chrome.exe	81
PID 5992 wrote to memory of 2176	5992	chrome.exe	81
PID 5992 wrote to memory of 2176	5992	chrome.exe	81
PID 5992 wrote to memory of 2176	5992	chrome.exe	81
PID 5992 wrote to memory of 2176	5992	chrome.exe	81
PID 5992 wrote to memory of 2176	5992	chrome.exe	81
PID 5992 wrote to memory of 2176	5992	chrome.exe	81
PID 5992 wrote to memory of 2176	5992	chrome.exe	81
PID 5992 wrote to memory of 2176	5992	chrome.exe	81
PID 5992 wrote to memory of 2176	5992	chrome.exe	81
PID 5992 wrote to memory of 2176	5992	chrome.exe	81
PID 5992 wrote to memory of 2176	5992	chrome.exe	81
PID 5992 wrote to memory of 2176	5992	chrome.exe	81

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://en.irna.ir/news/85519944/Russia-sends-coal-to-India-via-Iran-by-train-for-first-time
1⤵
- Drops file in Windows directory
- System Time Discovery
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb74d0cc40,0x7ffb74d0cc4c,0x7ffb74d0cc58
  2⤵
  PID:2316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1764,i,10857223897987600026,910357469292411538,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1760 /prefetch:2
  2⤵
  PID:3232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2056,i,10857223897987600026,910357469292411538,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2072 /prefetch:3
  2⤵
  PID:3732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2168,i,10857223897987600026,910357469292411538,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2372 /prefetch:8
  2⤵
  PID:2176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3088,i,10857223897987600026,910357469292411538,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3096 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3104,i,10857223897987600026,910357469292411538,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4568,i,10857223897987600026,910357469292411538,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4580 /prefetch:8
  2⤵
  PID:1512

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
723055544d5cfba2da7be463f8f57939

SHA1
a425a41c664edf59e6ca70309a25cf9671461b10

SHA256
cd6fe007b6db179333f99e2ea17c0f953162b38b94b040a82648552788fad063

SHA512
3c355c54e850320fd18bd5c94a54e322bb520ab4650bcb64f8f8940f8d8f8ed5d6028adf8ca16dc51eda16c582603fa56a0171bb40a9402510faae0af300b306

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
c51b05befae9e08826490a37d17ff2ec

SHA1
6eddc9ae3e849cc99de1f050c3f61bdcf3ac5cc1

SHA256
f95c9c4e723b61340117f8c2e7b04dfabe5d1d9c581138a2b173217595d02581

SHA512
5e49b0b67f22a85ab785fdb8d938217e652391881a09aa54ae2e90d77bdf4b7c2a435d1e1c994c11c7970fddbb95c6e96022885b064c7c99f550c157803c54a0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
2e45a2ccdfa72f6698ce66f71a9ffa24

SHA1
b26633aa9ac311e696bded29f5fe4b176da7fed0

SHA256
690ff18689d805b7fe38ac4436801b1b78b5c2776abae99ffecf132e0a2e0acd

SHA512
19052f4cf0b5c64c5fbb833b0ae2d3809d0ef64afffe90b158590f20053c9397b86290566d835f23340a95a372f5fbcdacec5dc3753756b68432e5b9b8baa679

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
bf82727c11a8fc3c7e2e0abcc16d09ef

SHA1
0cb23f38c88eca74a43e43e73f0b8d185580ca03

SHA256
ee666ab3790f566ab6d696b65b40f2a3df4eaa30f96766b75624fcae11a292bc

SHA512
b64c7294cd94e1d990b4a0da518e81bfdcbe14b37d1e969397ddbd3db65ff00e15c791551a6fc0a33dffb0340f092704a6cd7b5e5a67fb7f78108dab294716c9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
0e8ac890c1579868e2e56faa4daca2c4

SHA1
ec1ba255d7c985a7151fcb5fc154a92814cce90c

SHA256
8955a5f8c12250a1fb7a2625559a7b335e1f7b8212d3b238527f813adb12c493

SHA512
b2b8238e5cbedab6c9495b75c9cea9e4969856c2ec56d38ef5e34a63b5d50a54df6df4bbef085cada98edb1d6a11e40a51d7d38586c9441784447e351569a728

Download Submit